Re: barnyard2 not populating sig_name properly when using EMT rules

["Wm. Josiah Erikson" <wjerikson () hampshire edu>]

Thanks to everybody who pointed this out to me! I'm sure I must have 
missed something in the documentation that pointed me to this.
Thanks for the multiple quick, accurate and helpful responses.
     -Josiah



On 5/9/11 11:54 AM, Eoin Miller wrote:
> On 5/9/2011 3:35 PM, Wm. Josiah Erikson wrote:
> > Hi guys,
> >        Has anybody seen anything like this? When I use the default rules,
> > everything populates fine, but when I use the EMT rules, I get things
> > like "Snort Alert [1:2012648:0]" in the sig_name field in the signature
> > table. Looking at the rules definitions, I don't see any obvious reasons
> > why - the signature names are in the same place in the default and EMT
> > rules. Has anybody run across this before?
> >        Thanks,
> You need to update your sid-msg.map file to include the signature names
> for all the other rules you are loading. This happens when you use
> something like barnyard or barnyard2 processing unified output. I looks
> up the name of the signature in the sid-msg.map file to get the human
> readable names. If it isn't there, then it just uses the sid for the name.
>
> cat EMT/sid-msg.map>>  /etc/snort/sid-msg.map
>
> Then restart barnyard/barnyard2. Look into using something like
> pulledpork or oinkmaster, it handles and updates your sid-msg.map file
> for you automatically.
>
> -- Eoin
>
> ------------------------------------------------------------------------------
> WhatsUp Gold - Download Free Network Management Software
> The most intuitive, comprehensive, and cost-effective network
> management toolset available today.  Delivers lowest initial
> acquisition cost and overall TCO of any competing solution.
> http://p.sf.net/sfu/whatsupgold-sd
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users

-- 
Wm. Josiah Erikson
Network Engineer
Hampshire College
Amherst, MA 01002
(413) 559-6091


------------------------------------------------------------------------------
WhatsUp Gold - Download Free Network Management Software
The most intuitive, comprehensive, and cost-effective network 
management toolset available today.  Delivers lowest initial 
acquisition cost and overall TCO of any competing solution.
http://p.sf.net/sfu/whatsupgold-sd
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users